USDM Life Sciences and Oracle have partnered for more than 15 years to provide solutions that enable life science companies to meet FDA 21 CFR Part 11 and EMA EudraLex Volume 4 Annex 11 regulatory requirements. USDM has developed Validation Accelerator Packs (VAPs) for Oracle applications and has enabled hundreds of Oracle customers to successfully implement and quickly validate Oracle applications. With USDM Cloud Assurance for Oracle Fusion SaaS, customers are provided with continuous support of Oracle SCM releases to maintain compliance. This white paper highlights how USDM and Oracle work together to deliver a comprehensive solution for initial and ongoing validation and compliance maintenance of Oracle’s Cloud solutions.

1. | u s d m . c o m 1| u s d m . c o m
www.usdm.com
Oracle GxP
Cloud Assurance
Transformation and Innovation in Compliance and Technology

2. | u s d m . c o m
We Help Life
Science
Companies
Make an Impact
2000+
GxP Projects
20Years in Business
400+Clients Globally

3. | u s d m . c o m 3
USDM Solutions
Cloud & Technology
Content & Collaboration
Audits & Compliance
Validation & Testing
Data Management
Organizational Change Management
Operations & Program Management
Life Sciences Strategy
Emerging | Biotech | Med Device | Pharma

4. | u s d m . c o m 4| u s d m . c o m
Cloud Assurance
USDM’s Cloud Assurance™ is a subscription offering where USDM
handles the entire compliance workload from cloud vendor selection
through ongoing maintenance of the validated state, thus providing our
customers with a harmonized, consistent compliance experience
across all their cloud vendors.
Value to the Customer
• Cloud Vendor Compliance is Managed
• Lower Cost of Compliance
• Continuous Risk Mitigation
• Harmonized and Centralized Control

5. 5| u s d m . c o m
V E NDOR AUDI T GxP
AS S E S S M E NT
V ALI DATI ON
P LAN
US E R
RE QUI RE M E NTS
SPECI FI CATI ON
F UNCTI ONAL
RE QUI RE M E NTS
SPECI FI CATI ON
RI S K & I M P ACT
AS S E S S M E NTS
I Q/ OQ/ PQ
P ROTOCOL &
TE S T S CRI P TS
TRACE ABI LI TY
M ATRI X
VALI DATI ON
S UM M ARY
RE P ORT
Subscription includes updates to VAPs with each Oracle Release
Automated testing by USDM
Cloud Assurance Subscription keeps you compliant
USDM Cloud
Assurance Deliverables
Time and Cost Savings Strategy:
Leveraging Best Practices and Automation
• USDM Cloud Assurance reduces validation
time by 40 – 60%
• Minimizes compliance costs and client
workload
• Compliance is managed and maintained
• Consistent Validation Methodology

6. | u s d m . c o m 6
USDM Cloud Assurance
How it works
Vendor
Change
Impact
Assessments
Automated
Regressions
➢ Manage Vendor’s release
cycles
➢ Provide updates to Client
Validation documents (e.g.
specifications, test scripts)
Platinum
➢ Provide Impact Assessments
for Client’s specific use cases
(PQ)
Gold
➢ Conduct Impact Assessments
based on Release Notes
Platinum
➢ Run Automated Regressions on
Client Use Cases
➢ Provide Customer Specific
Reports and Analyses
Gold
➢ Run Automated Regressions on
System Core
➢ Provide Reports and Analyses
New Use
Cases
Change
Management
➢ Customer Success Architects
➢ Workflow-as-a-Service
➢ Platform Integrations
➢ Manage change management
process
➢ Author, route, approve and
close out change tickets in
Client’s QMS (Est. 1-3 per year)

7. 7| u s d m . c o m
Deployment Activity Capabilities
Details Client USDM Oracle
Develop solutions/applications and enhancements
Perform Testing at SDLC level
Perform Infrastructure Qualification
Validation Documentation (utilizing VAP)
• URS requirements specification
• Draft and approval of ALL validation documents (VAP documents as well as custom QA
requirements)
• Maintenance of validation and change control documentation
Audit and Part 11/Annex 11 Assessment
• Audit Oracle Infrastructure and QMS for cGxP readiness
• Part 11/Annex 11 Assessment of the Platform/Applications
Validation Execution
• Executing IQ/OQ/PQ Protocols –
• Oracle IQ is Infrastructure and QMS Qualification based
• USDM IQ elements verify those Oracle items as in place, as well the customer specific
configuration
• OQ is supplier leveraging and risk based – refers to Oracle SDLC Testing for std/OOTB low
risk items, as well as higher risk, configured and customer specific elements.
• PQ is customer-tailored testing of end to end business process functionality
• Deviation Handling (includes client deviations as well as issues with patches)
Ongoing Compliance Maintenance Post Go-Live
• Analysis of Release Notes
• Change Control Board (Oracle + USDM)
• Production of Validation and Verification Protocols
• Execution of mitigation/regression tests
Development of Additional application specific VAP’s (sitting on platform)
• Creation of VAP documentation and requirements for applications
System Implementation and Configuration
Implementation partner
Responsibility
Matrix
Primary Owner
of Activities

8. 8| u s d m . c o m
After Go Live
Subscription Service
• After initial system rollout and validation, USDM will provide the following documentation to support validation of
subsequent updates:
• Validation and Verification Protocol – For Updates to Existing Functionality
• Details the changes made in the release
• Assessment of the impact of the change
• Customer actions required to maintain the validated state of the system
• For New Functionality:
• Requirements
• OQ Test Scripts
• The Validation and Verification Protocol is not customer specific. The customer must decide, based upon the impact
assessment, which requirements and test scripts to include in the upgrade change request.
• Performance Qualification requirements are specific to each customer, and should be assessed by the customer
upon receipt of the Validation and Verification Protocol for existing functionality. (Included in Platinum Cloud
Assurance)
• Specific roles and responsibilities, i.e. protocol execution, are determined according to the needs of each customer.

9. 9| u s d m . c o m
Ongoing Validation Schedule
Subscription Service
• Oracle is planning 4 releases a year, one per quarter
• Best Practice for Life Science Customers to select Month 3 upgrade cycle.
• USDM receives release notes 4-6 weeks ahead of Month 1 release
• USDM to analyze changes contained in the release and begin preparing validation documentation updates for subscription
customers upon receipt of release notes. Only GxP functionality changes will be analyzed.
• Customer test pod update in Week 1 of the selected upgrade month. Production pod is updated in Week 3
of the selected upgrade month.
• Required validation testing to be executed after test pod update is received, but prior to update of
production pod.
• Pre-testing activities, such as change control initiation, requirements updates, test protocol pre-approvals,
etc., should be performed prior to upgrade of the test pod in order to maximize allotted testing time.

10. 10| u s d m . c o m
Ongoing Compliance Timeline
Task
Pre-Release Month 1 Month 2 Month 3
W
1
W2
W
3
W
4
W
1
W
2
W
3
W
4
W
1
W
2
W
3
W
4
W
1
W
2
W
3
W
4
USDM Analyzes Release Notes,
Determines Needed Changes,
Generates Requirements
USDM Updates Test Scripts
USDM Sends Test Scripts to
Subscription Customers
Customer Initiates Change
Control, Updates Requirements,
Pre-approves Test Scripts –
Prior to Upgrade of Test Pod
For
Month
3
Update
Test Pod Updates
Customer Test Execution
Production Pod Updates
Customer Close Out Change
Control

11. 11| u s d m . c o m
1 2 3 4 5Year
Private Cloud
Upgrade
• Slower, large
validations done
by a single team
and customer
• Large one-off costs
per significant
upgrade
• Re-validation/Re-
implementation
Private Cloud
Upgrade
Private Cloud
Deployment
GxP Data with Private Cloud
Establishing and Maintaining a validated environment

12. 12| u s d m . c o m
1 2 3 4 5Year
Incremental Updates
GxP Data with Cloud Assurance
Establishing and Maintaining a validated environment
• Fast, smaller, repeatable upgrade validations shared
by multiple customers
• Spreads cost across time and customers
• Lower overall cost
• Constantly up to date and compliant including
latest advances available
• Decreased burden to core business

13. 13| u s d m . c o m
Deployment Activity Capabilities
Details Client USDM Oracle
Develop solutions/applications and enhancements
Perform Testing at SDLC level
Perform Infrastructure Qualification
Validation Documentation (utilizing VAP)
• URS requirements specification
• Draft and approval of ALL validation documents (VAP documents as well as custom QA
requirements)
• Maintenance of validation and change control documentation
Audit and Part 11/Annex 11 Assessment
• Audit Oracle Infrastructure and QMS for cGxP readiness
• Part 11/Annex 11 Assessment of the Platform/Applications
Validation Execution
• Executing IQ/OQ/PQ Protocols –
• Oracle IQ is Infrastructure and QMS Qualification based
• USDM IQ elements verify those Oracle items as in place, as well the customer specific
configuration
• OQ is supplier leveraging and risk based – refers to Oracle SDLC Testing for std/OOTB low
risk items, as well as higher risk, configured and customer specific elements.
• PQ is customer-tailored testing of end to end business process functionality
• Deviation Handling (includes client deviations as well as issues with patches)
(PQ)
Ongoing Compliance Maintenance Post Go-Live
• Analysis of Release Notes
• Change Control Board (Oracle + USDM)
• Production of Validation and Verification Protocols
• Execution of mitigation/regression tests
Development of Additional application specific VAP’s (sitting on platform)
• Creation of VAP documentation and requirements for applications
System Implementation and Configuration
Implementation partner
Responsibility
Matrix
Primary Owner
of Activities

14. 14| u s d m . c o m
USDM Cloud
Assurance Options
USDM DocuSign Cloud Assurance Option 1
Cloud
Assurance
Basic
Option 2
Cloud
Assurance
Gold
Option 3
Cloud
Assurance
Platinum
Validation Accelerator Package (VAP) X X X
Annual Audit X X X
VVP (monthly release notes, impact assessments updates to DocuSign core
validation documents- Non Client Specific)
X X X
Initial Validation- Core functionality (OQ) X X X
Initial Validation- Customized for Client (PQ) X X
Test Execution (Core Releases) X
Ongoing PQ monitoring- Client use-case specific impact assessments and
validation documentation upkeep & PQ test execution (Annual Fee, Billed Annually)
X
Change Management/ Control (Specific to Client) X
Not
Recommended
for Oracle GxP
Cloud

15. 15| u s d m . c o m
✓ Built upon USDM’s 15+ years of experience validating Oracle
technologies
✓ USDM Cloud Assurance methodology has been used by over 75
life science organizations in the past 5 years
✓ Provides validation of cloud applications in weeks, not months
✓ Allows faster implementation and use of new products features
✓ Compliance is maintained, continuous and cost is spread across
multiple clients– no validation “team” required. Save FTE’s and $
✓ Take advantage of validation in small, incremental doses and say
goodbye to “big bang” upgrades
✓ Program has been successfully audited by regulatory bodies
Why USDM Cloud
Assurance

16. | u s d m . c o m 16
USDM Contact
Information
Todd McKendrick
Head of Accounts
tmckendrick@usdm.com
831-461-4112
usdm.com
@USDMlifesciences
@USDMlifescience
Ryan Gleason
Account Management
rgleason@usdm.com
805-308-6221